The Information Commissioner’s Office (ICO) has launched a consultation on its corporate strategy, offering interested parties an opportunity to shape how the ICO develops as it undergoes a significant period of change.

One of the Data Use and Access Act’s many features was confirmation that the ICO would be transformed from a model that saw all powers and responsibilities vested in a single Information Commissioner into a new ‘Information Commission’, complete with a Chair, Board, and separate CEO. The draft strategy sets out the ICO’s priorities and ambitions as that transition gets underway, covering the period from 2026 to 2028.

Although framed as a corporate strategy rather than a policy consultation, the document provides a useful indication of where the ICO intends to focus its regulatory attention over the next three years, as well as how the ICO’s sees its relationships with its various stakeholders. In the case of  businesses, the ICO commits to “providing clarity, highlighting responsible practices and to taking proportionate, targeted action against those whose poor practice undermines the standards responsible organisations work hard to maintain”. For their part, businesses are expected to focus on “achieving legal compliance, demonstrating accountability and engaging with [the ICO] openly when innovating”.

In addition to setting out the nature of the ICO’s work, its regulatory approach, and plans for how it will operate in the future, the consultation also sets out four proposed priorities:

1. Personal data that helps, not harms, children. The ICO states that it will work with partners around the world to “ensure providers in the digital and education technology sectors recognise (1) the specific risks their services represent for children, and (2) embed a privacy by design approach”.
2. Promoting trust and transparency in AI. As the development and public adoption of AI grows, the ICO sees itself as playing a ‘critical role’ in providing clarity to businesses on the responsible use of personal data in AI, reinforcing responsible innovation, and ensuring people can “engage confidently in an AI-powered economy”.
3. Public services that use people’s data responsibly. Pointing to surveys suggesting that fewer than half of people trust the Government to keep their data safe, the ICO commits itself to help increase trust by improving responsible data practices in the public sector.
4. Building cyber resilience to keep people’s data safe. Pointing to the UK’s unenviable position as the most targeted country in Europe for cyber attacks, the ICO says that it will help strengthen cyber resilience and reduce the impact of data breaches by, for example, helping responsible organisations innovate confidently and holding negligent or irresponsible actors to account.

The consultation closes on 23 August 2026 and can be found here.